International Association of Privacy Professionals

Skip to Content OPINION What a pioneer "phone phreak" can teach today's professionals about creativity, adaptation and finding their superpower. Brian Hengesbaugh CIPP/US Global Chair, Data and Cyber Baker McKenzie Editor's note The IAPP is policy neutral. We publish contributed opinion pieces to enable our members to hear a broad spectrum of views in our domains.

I have always found deletion to be one of those privacy rights that sounds simpler on paper than it is in practice. Removing a record is one thing but showing that it disappeared from every place it was copied, derived or sent is something else entirely. That's why a recent development in California caught my attention. On 7 Aug., the California Privacy Protection Agency released a preliminary audit proposal that would require data brokers to prove that deletion requests actually work.

As I write this, the monsoon is in full flow across much of India, and the country is preparing to celebrate its 80th Independence Day 15 Aug. For those of us tracking digital trust and governance, however, the past month has been less about reveling in the aroma of freshly wet earth that is the hallmark of this season and more about trying to keep pace with a rapidly evolving digital landscape.

I found myself chatting with a fellow dog owner about work the other day. She turned out to be a human resources director at a big supermarket chain in Belgium. I asked what her top issue is now, expecting something about dreadful layoffs or abusive medical certificates which spur a lot of chatter here.

One of the major new features introduced by Chile's Personal Data Protection Law (Law No. 21,719) is the introduction of the data protection officer. Although the role is, in principle, voluntary and only mandatory for those entities that adopt an infringement prevention model, as highlighted in a previous analysis, the question we must now ask is: within which area should the DPO be placed, and to whom should they report?

Skip to Content ANALYSISMEMBER South Korea is poised to let controllers use personal data, original and non-pseudonymized, for AI development without the data subject's consent and beyond the original purpose of collection, subject to PIPC approval. Kyoungsic Min AIGP, CIPP/E, FIP Country Leader, South Korea, IAPP; Privacy Counsel and Asia Regional Lead VeraSafe South Korea is one plenary vote away from rewriting the legal basis for artificial intelligence training data.

Singer-songwriter and businesswoman Rihanna built Fenty Beauty into a billion-dollar enterprise by doing what the beauty industry was too slow to do on its own: seeing people who had been ignored and making products for them. Forty-four foundation shades at launch in 2017 was not a marketing stunt; it was a business philosophy built on accessibility, visibility and inclusivity.

California's data broker enforcement entered a new phase when requirements related to consumer requests through the Delete Request and Opt-out Platform became enforceable 1 Aug. At its 7 Aug. board meeting, the California Privacy Protection Agency noted 30% of registered data brokers began processing DROP requests in the first week following the compliance deadline, with 450,000 requests submitted to date.

Another remarkable chapter in New Mexico's litigation against Meta just concluded with a meticulous judgment from state court judge Bryan Biedscheid, imposing liability under a first-of-its-kind theory. Like lead paint manufacturers or polluting factories, Meta is being held responsible for the contributions its platforms made to the "public nuisance" of the mental health crisis among young people in New Mexico.

Transparency is easy to support in principle. It becomes more interesting when someone must decide where the label appears, who applies it and what happens when content moves between systems. As of 2 Aug., that is no longer a hypothetical exercise for organizations subject to the EU Artificial Intelligence Act. The latest transparency obligations under Article 50 are now in force, and that's important for some Canadian organizations to know.